Building Resilient Software Systems: Lessons from Cybersecurity Incidents

1. Keeping Software Updated and Patched: The ProxyLogon Cyberattack

One of the most damaging cyberattacks in recent years was the ProxyLogon cyberattack. After discovering vulnerabilities in the on-premise versions of Microsoft Exchange Server 2013, 2016, and 2019, Microsoft released a security patch in March 2021. Unfortunately, many organizations were slow to apply this patch. So, as more groups began to join Hafnium (the hacking group responsible for initiating the attack) in exploiting the vulnerabilities, the damage quickly mounted. Therefore, affecting government agencies, businesses, and educational institutions all over the globe.

The devastating impact of the ProxyLogon attack underscores the importance of regularly patching and updating software. Neglecting these updates is an open invitation for hackers to exploit the vulnerability. Failing to stay vigilant and keep your software systems updated will expose your company.

2. Developing and Testing Incident Response Plans: The Log4Shell Attack

In December 2021, a critical zero-day vulnerability known as Log4Shell was discovered in Apache Log4j. It is a widely used logging library for Java applications. Hackers wasted no time in exploiting the vulnerability to launch attacks. The Log4Shell vulnerability provided them with unauthorized access to targeted systems and the ability to execute malicious code.

There are a lot of lessons to learn from the Log4Shell attack, including the importance of keeping software updated. However, one of the biggest lessons to learn from this attack, is the importance of developing a thorough incident response plan. Organizations had to respond quickly to the threat because attackers rapidly exploited the Log4Shell vulnerability, causing severe damage. Those with effective incident response plans fared much better than those without them.

A well-prepared incident response plan is vital in the face of rapidly spreading threats such as the Log4Shell attack. When every minute counts, preparing and organizing will allow your organization to respond much more rapidly and effectively. Considering the enormous cost of downtime (in terms of lost productivity and reputational damage), this ability to detect and resolve incidents such as the Log4Shell attack as quickly as possible is of the utmost importance.

Therefore, federal agencies can develop the comprehensive incident response plans needed. They will address emerging threats rapidly and effectively with help from a cybersecurity consulting service firm i-Link Solutions.

3. Securing Your Software Supply Chain: The SolarWinds Attack

The SolarWinds attack came to light in December 2020. The world was already grappling with the consequences of the COVID-19 pandemic. Rather than targeting organizations individually, the SolarWind attack started by infiltrating SolarWinds Orion. It is a popular network management and monitoring solution used by numerous organizations. It includes government agencies, corporations, and critical infrastructure providers. This allowed the threat actors to inject a malicious backdoor into the software updates subsequently distributed to SolarWinds customers.

What makes the SolarWinds attack especially a destructive example of cybersecurity gone wrong is the fact that the attack didn’t target a single organization. Instead, it was able to spread to systems all over the globe in a relatively short amount of time. The SolarWinds attack infected over 18,000 systems worldwide, with an estimation of billions of dollars in damages.

The SolarWinds attack showcases that choosing your software vendors wisely is just as important as ensuring your own internal security. To avoid vulnerabilities in third-party software becoming vulnerabilities for your company, it is vital to perform thorough due diligence. This is to ensure that each vendor you work with employs effective security controls and practices. Conducting routine security assessments on all of the software vendors you work with will help you avoid falling victim to a third-party company’s shortcomings.

Thankfully, a new executive order requiring software vendors to provide a Software Bill of Materials (SBOM) is also poised to help improve software supply chain security. This will improve transparency for organizations purchasing third-party software, enabling more comprehensive and reliable risk assessments.